FortiGuard Center
Threat Research and Response
Prevalence Report
Threat Landscape Report - November 2009 EditionThe following statistics are compiled from Fortinet's FortiGate network security appliances and intelligence systems for the period October 21st - November 20th, 2009.
Exploits and Intrusion PreventionTop 10 Exploitations & RegionsTop 10 exploitation attempts detected for this period follows, ranked by the number of valid attack cases reported. Valid attack cases consist only of threats we have listed as a Threat Outbreak on our FortiGuard Center (RSS feed here). Percentage indicates the portion of activity for which the attack accounted out of all cases reported this period. Severity indicates the general risk factor involved with the exploitation of the vulnerability, rated from medium to critical. Figure 1a below shows the Top 5 regions attacked in comparison to total attack cases reported this period. Critical issues are outlined in bold.
 Figure 1a: Top 5 regions by number of attack cases New Vulnerability Coverage
Malware Today
Regions & VolumeTop 5 regions for this period, ranked by distinct malware volume reported. Distinct malware volume indicates the amount of unique virus names (variants) that has been detected in the given regions, as opposed to total malware volume, which indicates the accumulated amount of all reported incidents. Total and distinct malware volume trends for the last six reporting periods are also given. Figures 3a-3c below show these statistics:
For more information on daily activity per region, please visit our Virus World Map. Spam and Email Threats
Top 3 In The WildTop three email threats observed for this period. Top e-mails have been filtered to highlight diverse campaigns by removing duplicates and unsolicited advertisements. This helps focus on scams and malicious intent; the resulting list is ranked by Figures 5a-c below illustrate the most popular message tactics used during recent spam campaigns:
Crawling The WebThreat Traffic & GrowthThe following list breaks down the percentage of activity blocked for selected Web categories throughout this period. Percentage indicates how much activity was accounted for out of the four selected categories. Figure 6a shows a different scope, comparing only threat traffic: Malware, spyware, and phishing. The percentage shown in Figure 6a below indicates how much activity was accounted for out of these three threat categories. Figure 6b highlights the growth (or reduction) of selected web threat activity when compared period over period:
Activity RecapMalware continued to be distributed in peak volume this period, building off a charge that began in September 2009. Last report, Bredolab and Scareware were the main occupants in our malware top 10 listing -- and were setting records in terms of daily detected volume. Now, a battle of the bots has ensued with Pushdo / Cutwail firmly taking the reigns. In latest developments, we observed a Pushdo variant attempting to remove "grpconv.exe" - a binary associated with Bredolab. Malicious code has been discovered in the past to remove other threats (Netsky vs. MyDoom, Storm vs. Stration). The Pushdo botnet is known to download the Cutwail trojan, among other components. Two variants of the Cutwail trojan accounted for over 30% of total malware activity this report, ranked #1 and #2 in our top ten listings. Looking at Figure 2, we can see that Cutwail did this in tremendous volume, smashing the daily records set by Bredolab & Scareware last report (nearly double). This activity was a large contributor to the sharp rise in total volume we have observed in Figure 3b. The Cutwail seeding campaigns were largely observed during the first week of November, which used simple social engineering tactics: emails using the subject "Hello Darling," with Cutwail attached as "photos.zip." Other campaigns included UPS/DHL invoices, similar to Bredolab. Once installed, Cutwail will mass mail new spam templates it has received. In November, we observed templates advertising pirated software for sale, typically between $60 and $230 USD. Cutwail is also known to frequently send pharmacy spam such as Canadian Pharmacy, highly profitable just like Scareware due to affiliate programs with high payouts. ZBot and Scareware remained highly active next to Pushdo / Cutwail. Figures 5a and 5b show ZBot spam campaigns taking different approaches. The first shows a two-stage attack which first phishes for Facebook credentials, then attempts to install the malicious ZBot binary. The second is targeting Verizon Wireless customers, attempting to get recipients to install a "tool" which is in fact ZBot. Figure 5c shows one of at least three distinct spam campaigns used to seed a new trojan downloader (also known as "Loaders") - Sasfis. Sasfis detection was very high this period, with variants landing in our malware top 10, ranked #3 and #10. The two other spam campaigns we observed with Sasfis this report used the subjects 'Mailbox has been deactivated' and 'Facebook updated account agreement' - both with ".zip" attachments containing the trojan. This loader reports to its controller through HTTP by posting information such as a unique bot identifier (similar to Bredolab), and will then await instruction to download updates and further malicious components. We continue to monitor this prevalent threat. In terms of reported attack cases, Adobe.Products.SWF.Remote.Code.Execution moved into third place this month while MS08-067, notoriously exploited by Conficker, remained in first. Flash and actionscript are constantly targeted to exploit systems, with technologies being leveraged such as Flash run-time packers. New developments this period include an out-of-band patch for Adobe Shockwave (APSB09-16), a zero-day vulnerability with Internet Explorer (CVE-2009-3762), a Windows 7 DoS, and a new worm targeting jailbroken iPhones. November has been very active for iPhones with 4 new attacks exploiting a misconfiguration of OpenSSH on jailbroken devices: malware targeting Dutch iPhones for ransom ($7 USD), a tool stealing SMS and contacts (HackerTool/iPhoneStealer), a worm changing the background image and another one trying to steal banking credentials (iPhoneOS/Eeki). These are all areas in which threats will likely continue to develop, so be safe out there - keep all software up to date, and employ a valid intrusion prevention system to guard against vulnerabilities and zero-days. FortiGuard Labs continues to monitor threats to provide up-to-date detection, while actively discovering zero-day flaws to provide true zero-day protection. SolutionsCustomers who use Fortinet’s FortiGuard Subscription Services should already be protected against the threats outlined in this report. Threat activity is compiled by Fortinet's FortiGuard Labs using data gathered from its intelligence systems and FortiGate™ multi-threat security appliances in production worldwide. FortiGuard Subscription Services offer comprehensive security solutions including antivirus, intrusion prevention, Web content filtering and antispam capabilities. These services enable protection against threats on both application and network layers. FortiGuard Services are continuously updated, which enables Fortinet to deliver a combination of multi-layered security intelligence and true zero-day protection from new and emerging threats. These updates are delivered to all FortiGate, FortiMail and FortiClient products. |
